How to Verify a Bank’s Official Website and Mobile App

Before you enter your bank login details, approve a transaction or download a banking app, confirm that you are using the bank’s genuine website or application. Fraudsters often create convincing copies of bank pages and apps to steal passwords, card details, PINs and one-time passwords.

A professional logo is not proof that a platform is official. Fake websites can look almost identical to legitimate ones, while fraudulent apps may use a bank’s name and branding. The safest approach is to verify the platform through more than one trusted route before using it.

Start from a source you already trust

The safest way to reach a bank’s online service is to begin with information you obtained directly from the bank. Useful sources may include:

• The bank’s official debit card, welcome letter or account-opening documents
• A verified branch notice or information displayed inside the bank’s premises
• The bank’s official customer-service channel, reached through a trusted source
• The official app-store listing linked from the bank’s genuine website
• A banking USSD code printed on official materials or confirmed by the bank

Be careful with links received through WhatsApp, text messages, emails, social media comments or online adverts. A message that says your account will be blocked unless you act immediately is a common warning sign. Do not use the link simply because it contains the bank’s name.

How to check a bank website

Inspect the domain name carefully

Look at the website address in the browser’s address bar. Scammers may register addresses that resemble a bank’s name but contain extra words, unusual spelling, numbers or different domain endings.

For example, a fraudulent address might place the bank’s name in a longer domain such as bank-security-example.com, even though the real bank uses a different official domain. The important detail is the registered domain, not just the words shown at the beginning of the address.

Watch for:

• Misspellings or swapped letters
• Extra hyphens, numbers or words
• Unexpected domain endings
• Shortened links that hide the destination
• Addresses containing a bank’s name but belonging to another organisation

Do not assume that a padlock icon proves a website is genuine. A padlock generally indicates that the connection is encrypted; it does not prove that the organisation behind the website is your bank.

Type the address yourself when possible

If you know the bank’s official web address, type it directly into your browser instead of clicking a link in a message. Save the verified page as a bookmark after checking it. This reduces the chance of returning to a fake page later.

Search engines can also help you find a bank’s website, but treat advertisements and unfamiliar results carefully. A fraudulent advertiser may appear above the real result. Confirm the address before opening a login page.

Check whether the website behaves normally

A genuine bank website should not pressure you to reveal information that bank staff should never request, such as your full PIN, password, card PIN, online-banking password or an OTP. Be suspicious if a page:

• Requests your ATM PIN or asks you to “confirm” it online
• Asks for several OTPs before you can continue
• Requests your card PIN, recovery codes or complete security answers
• Uses threatening language or an unrealistic emergency
• Contains many spelling errors, broken links or strange pop-ups
• Requires you to install an unknown application or browser extension

Legitimate security checks can vary, but you should never disclose sensitive credentials to someone who contacts you unexpectedly. If you are uncertain, close the page and contact the bank through an independently verified channel.

How to verify a mobile banking app

Use the official app store

Download banking apps only from the Google Play Store or Apple App Store, preferably by following the app link from the bank’s verified website. Avoid APK files sent through WhatsApp, Telegram, email or a website you do not recognise. On an Android phone, an APK installed from outside Google Play can expose you to additional risk.

Before installing, compare the app listing with information from the bank. Check:

• The developer or publisher name
• The bank’s spelling, logo and description
• The number and quality of reviews
• The app’s update history
• The developer’s listed website and support details
• The permissions requested by the app

Reviews alone do not prove that an app is genuine. Fraudsters can manipulate reviews, and a genuine app may also have complaints from users experiencing technical problems. Treat the listing as one part of the verification process.

Review app permissions

A banking app may need certain permissions to support features such as notifications, biometric login or contactless services. However, be cautious if an app asks for access that does not make sense for its stated purpose, including broad access to messages, contacts, accessibility controls or device administration.

Do not install an app merely because someone claiming to be a bank representative instructs you to do so. If a support agent asks for remote-control software or tells you to share your screen while you log in, stop the conversation and contact the bank independently.

Confirm support channels before calling or chatting

Scammers may create fake customer-care accounts on social media or place false phone numbers in search results. A blue tick or professional-looking profile is not enough by itself.

Use the contact details shown on the bank’s verified website, official app or account documents. Never rely on a phone number sent by an unknown person. When you call, do not disclose your PIN, password, OTP, card PIN or full authentication credentials. Bank representatives may ask questions to identify you, but you should be cautious about any request for secret security information.

Be especially careful with unsolicited “account recovery” messages. A genuine bank will not need you to transfer money to a personal account to secure your funds. It should also not ask you to send an OTP to an agent through WhatsApp or a phone call.

Use a simple verification workflow

Before logging in, pause and follow this process:

1. Stop. Do not enter any details while you are feeling pressured.
2. Check the route. Ask how you reached the website, app or support account.
3. Inspect the address or app listing. Look for the correct domain, developer and spelling.
4. Verify independently. Compare the details with the bank’s official website or account documents.
5. Contact the bank directly. Use a trusted number or visit a branch if uncertainty remains.
6. Proceed only when satisfied. Keep your PINs, passwords and OTPs private.

What to do if you used a suspicious website or app

Act quickly, but do not panic. Stop using the suspicious platform and contact your bank through a verified channel. Explain what happened and ask whether the account, cards or digital-banking access should be restricted.

Change your online-banking password from a confirmed official platform. If you disclosed card information, ask the bank whether the card should be blocked or replaced. If you installed an unknown app, remove it and review your device for unusual activity. You may also need to change important email passwords, especially if your email is used to recover your banking account.

Keep screenshots, phone numbers, messages, website addresses and transaction information. These details may help the bank, your mobile network or law-enforcement authorities investigate the incident. Do not send additional money to anyone promising to recover lost funds.

The safest habit

Verify before you trust. A real bank will not require you to surrender your PIN, password or OTP to solve an urgent problem. Access online banking through a route you have independently confirmed, download apps only from trusted app stores, and treat unexpected messages as unverified until the bank confirms them.

For Nigerians using mobile banking, USSD, apps and web portals, the same principle applies: the familiar logo is only the beginning of the check. The domain, app developer, contact channel and request for information must all make sense before you continue.